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1N THE CLAIMS 

Amended claims follow: 

1. {Currently Amended) A computer program product embodied on a tangible 
computer readab l e medium in a computer storage medium comprising a computer 
program operable to control a computer to detect a know n computer program within a 
packed computer file, said packed computer file being unpacked upon execution, said 
computer program comprising: 

resource data reading logic for reading resource data within said packed computer 
fde. said resource data specifying program resource items used by said known computer 
program and readable by a computer operating system without dependence upon which 
unpacking algorithm is used by said packed computer file; and 

resource data comparing logic for generating characteristics of said resource data 
and for comparing said characteristics of said resource data with characteristics of known 
computer program resource data and lor detecting a match with said known computet" 
program indicative of said packed computer file containing said known computer 
program; 

wherein said resource data of said packed computer file is processed to generate 
ftngeipniu data and to eompaie said geneiated imgeiprmt data v\Uh knov\u computer 
piogiam imgerpnnt data, 

whet an vud geneuned fingetpnnt data unhides a rmwbu ot ptogiam tcsomee 
items specified withm saul resouue data oi ~,aid packed computet Hie. 

w herein said gcnciated tmgeiptun data includes <j tlag indicating which dat i ^ 
included within sard gcnCiated hntieipuni data 

whet cm said gcnciated ttngeipunt data includes a location within saul icsoukc 
data ul s<-ud packed computer file oi an uiti\ spucilvmg a ptogtam Ksouiec item basing a 
largest size; 

whctcm saui generated fingciptnu data includes a checksum \aluc laknlatcd in 
dependence upon: 
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a numbc of said program resource items specified beneath each node w ithin 
htcrarchrcally arranged resource daia of said packed computer tile. 

siring names associated with saidprogiam resource items wjtbm said it-source 
data of said packed computer file, and 

m/cs of said program resource, items w nhm haul resource, data ol said packed 
computer Hie . 

1. < Original) \ computa program product a^ claimed in chum t. wherein y<ud 
known computer program is one of 

a 1 rojart computer program, and 
a worm computer program. 

\ fCnnenth Amended) A computet program product as? e tanned nt claim K 
\s herein sard resource dataol said packet! computer file comparing logic rs operable to 
compare said resource data wslh character) sues of a plurahh of known computet 
programs to detect f! said packed computer program contains one pf said pluralri) of 

known computer programs. 

4. (Cancelled) 

■> (Ongmil) \ eompuia progs im product a- claimed in claim L wherein said 
program resource items used by said known computet program include one or more oj 
icon data; 
string data; 
dialog data; 
bitmap data; 
menu data; and 
language data. 
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0 <C urrenUy Amended) A computer program product as- claimed in claim I, 
wherein said resource daia of said pdeked computer file specifies for each resource item .1 
storage locatnm uf said resource Hem, 

n . {Original) A computer program pioduct <-is claimed in claim (\ \\ herein said 
storage location of said resource item is .specified as an reiatiw offset sakk. 

S. {Currently Amended) A computes program product a^- claimed in claim t. 
wherein sdid resource data of jaid packed computer file specifies lor each resource item a 
size of said resource item. 

9. (Cancelled) 

10. (Cancelled) 
.1 1 . (Cancelled) 

1 2 tt intently Vraeuded) A computer program pioduu as claimed m ihnm !. 
whet cm said gen et a tc d fi ngcrpt s n t data mcimKs tunestamp data indicative oi a tuiK of 
compilation of s<-ud known uomputer program 

13, (Cancelled) 

14, (Currently Amended) A computer pi ogram prndues as churned in claim (f^JJl, 
wheiein said checksum value is rotated between each item being added into said 
checksum. 

15, (Original) A computer program product as claimed in claim L wherein said 
packed computer file includes an unpacking computer program which upon execution 
decompresses said known computer program. 
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l<>, (Original i A computer proatam product as claimed in claim I . w heieni said 
packed computer file is a \\ in32 PL tile 

I" (Curt*_nti\ Amended) \ computer program piodut:t--eHtlH'nl^-t-ffl--iHftagtbk' 
computet readable medium m a computer storage medium comprising a computet 
prog! am operable to control a computer to genenue data loi duectmg a known computer 
progium wrthm a pacied computet hie. said packed computet file being unpacked upon 
execution, said computer program comprising 

resource data reading logic tbi leading icsoruec data within >aid packed computer 
fife, said resource data specifying program resource tienis used b\ said knov>n computer 
program and readable by a computer operairng ssstem without dependence upon which 
unpacking algorithm is u>ed b\ said packed computet die, and 

ehai actor tsttc data generating logic for geneiatmg chatacteisstsc data associated 
with said resource delta for comparison v\Uh characteristic data ol known computer 
program te^ouree data to detect a match with sard known computer program indicative of 
said packed computer file containing said known compuier program. 

wherein said resource daia of sard packed computer file is processed to generate 
fmgetpimt data and to compate said generated fingerpnut data with known computet 
program fingerprint data. 

wherein sard gejiaated .linger pr tin daia includes <\ number ol'piogram resource 
items speulied within said resource data of said packed computer file; 

wherein said gene.taicd fingerprint data includes a flag indicating winch data is 
mduded w ithm said generated fmget print data, 

wherein said generated imgcrpnni data includes a location within said resource 
data o( said packed computer file of an cntr> ,~,pecif\iiig a piogiara tesouree item ha\mg a 
largest size; 

w herem said genctatcd fitigctptmt data includes a checksum value calculated m 
dependence upon: 

a number ol progtam resource items specified beneath each node within 
hierarchic alh arranged resource data of said packed computet file. 
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string names associated with program resource items within said resource data of 
said packed computer rile: and 
^.^.yd^iogmm^^ 

file. 

18. (Original) A computer program product as claimed in claim 17, wherein said 
known computer program is one of; 

a Trojan computer program; and 
a worm computer program, 

10 (Pieuoush PiescmecU -\ computet piogram pioduetas claimed in claim 17. 
wlteiein said Jiameteristie data generating logic is opesable to generate eharaetemUe 
data tiom a pluraht\ of known computet piograms to enable detection of an\ of said 
piitniith of known computet programs wiihm said packed computer program 

20. (Cancelled) 

21 tOugirmll V computer ptogmm ptoduct as cianu^d in iUum ! 7, wheteui said 
ptogiam :csomcs uem- us^d b\ vnd known computet piogtam include one ot ntoie ot 

icon data; 
struts: data; 
dialog data; 
bitmap data; 
menu da ta; and 
language data. 

22 \i Lutcnth Amended) A computer piogram ptoduct as c fanned m claim ! 7. 
unciein said icsourec dau ol said packed computet mIc specifies foi eieh i\soutec item a 
storage location of said resource nem 
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23, (Original i A compiler program product as claimed in claim 22, wherein said 
storage location of said resource item is specified as an relative offset value. 

2 I (Curt*_ml\ Amended) \ computer program product as claimed ui claim 1 A 
therein said resoin^e data ul said packed computer file specifies lor each iesoui.ee uem a 
sj/e of said tc-outce Hem 

25. (Cancelled) 

26. (Cancel led) 

27. (Cancelled) 

28 ((_ uitenth Vmended) A computer program pioduet as claimed m tlanii 1 7, 
whercm said generated finger nam ddta includes hmestamp ddta indicative oi a time of 
compilation of said known toinputej piog;am 

29. (Cancelled) 

30 (CuiiurtK \mended) \ computer piogunn pioduet as claimed in claim 
f[25]]lZ- w Heiein said checksum \aliu is rotated between each uem being added into said 
checksum. 

"U (( h'jginal) \ computet program product as claimed in claim i"\ w herein said 
packed computer ulc includes an unpacking computet piogtam winch upon execution 
decompresses said known computer program 

32, (OngmaB A computer program product as claimed in Jatm 1 A wherein said 
packed computer file is a \\ in32 PI isle 
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33, (Currently Amended) A method of controlling a computer to detect a known 
computer program within a packed computer tile, said packed computer file being 
unpacked upon execution, said method comprising the steps of: 

reading resource data within said packed computer file, said resource data 
specifying program resource items used by said known computer program and readable 
by a computer operating system without dependence upon which unpacking algorithm is 
used by said packed computer file: and 

generating characteristics of said resource data and comparing said characteristics 
of said resource data with characteristics of known computer program resource data and 
detecting a match with characteristics of said known computer program indicative of said 
packed computer tile containing said known computer program; 

wherein said resource data of said packed computer fife is processed to generate 
fingerprint data and to compare said £enejated.tlngerpririt data with known computer 
program fingerprint data; 

wherein said ;ie n e rat ed i n merpr i 1 i s. data includes a number of program, resource 
items specified within said resource dat a of said packed computer illc : 

wherein said generated fingerprint data includes a Hag indicating which data is 
included within said generated fingerprint data; 

wherein said generated fi ngerprim data includes a location within said resource 
data of said packed computer file of an entry specifying a program resource item having a 
largest size: 

whcrein.said 
dependence upon : 

a number of program resource items specified beneath each node within 
hiejiuxhieaj^ 

string names associated with program resource items within said resource data of 
said packed computer file; and 

sizes of program resource items within said resource data of said packed computer 

file. 
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34, (Original) A method as claimed in claim 33, wherein said known computer 
program is one of: 

a Trojan computer program; and 
a worm computer program, 

35 (C unerrth Vmui«kJ) V method as Jaimed in tKum 33. \\ hetetn said step oi 
conip.ii mg compares said tesouiee data oi satd pat led lomputei hie w uh tlu ractenstics 
of a pluiatu) ot known computer programs to detect if said pat led computet ptogiam 
toutams one of said phirahts oi hionti computet progtams 

36, (Cancelled) 

^7 tOttgmah A method as claimed at eSatm V> wheiein safd ptogiam tesouu e 
items used h> saui known eomputa piovrtam include one ot moie of 
icon data; 
string data; 
dialog data; 
bumap data; 
menu data; and 
language data. 

\S tCuneniK Amended) A method as claimed m ddim Vi, whetctn said tesuuiee 
data ol sani packet! computet Hie speufics loj each tesouice item a sun age iocahon oi 
said resource item. 

V> tOugtnah A method as claimed m ciatm 18, whetctn said stotage Sotaiion o! 
said resource item is specified as an relative offset value. 

40 (Cut tenth \tnended) \ method as datnted tn dams *3. wheiem said resource 
data of said pat led computet file speeiises for each resource item a st/e of said resource 
item. 
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41. (Cancelled) 

42. (Cancelled) 

43. (Cancelled) 

44 (Current!) Amended) \ method as claimed in claim 3 4. whcresn said 
genet j led 11 tn.'et'pi nil data mUudes inuestamp data mdk aine ol a time ol tompilation oi 
said known compute! ptogiam 

45, (Cancelled) 

4(>. {L uriemK Amended} A method as (.fanned m chum j[4i j|33, w herein said 
check Mim \alue h totaled between each item being added into i>usd checksum 

4" (Original ) A method as claimed m claim 33. wherein said packed computer 
file includes an unpacking computet piogiam winch upon execution det ompt esses said 
known computer program. 

48. (Original) A method as claimed in claim 33, wherein said packed computer 
file is a Win32 PE file. 

4°- (Cm rait h Amended) \ method ol controlling a computci to generate data for 
detecting a known computet piogiam wjtbw a packed computet Ida said packed 
computet flic being unpacked upon execution said method eompnstng the steps ol 

teadmg ie-.ouiee data within said packed computet iile. -.aid icsouice data 
specs !>mg piogram icsouree items used b\ said known compute: piogram and seadahk 
b\ a compuiei opeiating system without dependence upon which unpacking algontfun is 
used b) vud packed computet file, and 
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generating characteristic data associated with said resource data for comparison 
with characteristic data of known computer program resource data and detecting a match 
with said known computer program indicative of said packed computer Hie containing 
said known computer program: 

wherein said resource data of said packed computer file is processed to generate 
fingerprint data and to compare said general ed fi n gerpri n t data with known computer 
program ■fingerprint data; 

wherein said generated, fingerprint data includes a number of program resource 
items specified within said resource data of said packed computer file ; 

wherein said generated fingerprint data includes a flag indicating which data is 
included within said generated tin gerprin t data; 

wherein said ge n era ted fin gerprin t data includes a location within said resource 
data of said packed computer file of an entry specifying a program resource item having a 
largest size; 

wherein said generated fingerprint data includes a checksum value calculated in 
dependence upon: 

a number of program resource items specified beneath each node within 
hierarchy 

string names associated with program resource items within said resource data of 
said packed computer tile: and 

si/c> of program resource items within said resource data of said packed computer 

file. 

50, (Original) A method as claimed m claim 49, wherein said known computer 
program is one of: 

a Trojan computer program; and 
a worm computer program, 

s 1 (Pieuouslv Ptesemedl \ method as l fanned m claim 40. v\heiem vitd step of 
generating generates chaiaetenstie data fiont a pluralst) of known computer programs to 
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enable detection of any of said plurality of known computer programs within said packed 
computer program , 

52. (Cancelled) 

53 (Original) A method as Jamted m claim W. whs rein said progtam icmuitcc 
items used b\ said known computet ptugiam include one o? mote oi. 

icon data; 
string data; 
dialog data; 
bitmap data; 
menu data: and 
language data. 

54 (C uncnth Amended) -V method as claimed in claim 4°. wheiem said source 
data ol said packed computer file specifies kn eael) jcsouilc item a sio;age location ol 
said resource item. 

55. (Original) A method as daimed in claim 5-4. w herein said storage location of 
said resource item is specs tied as an relative ulTsei \alue. 

56. (Cunendv Amended) A method as claimed in claim 4°, u herein said resource 
data ol said packet! computer file specifies lor each resource item a sue ol said resource 

item, 

57. (Cancelled) 

58. (Cancelled) 



59. (Cancelled) 
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60. (CuaciuK Amended) A method as claimed sn claim 49, wherein i»akl 
acncr.it cd li u gerpriu L daui includes tirnestamp data, indicative of a time of compilation of 
said known computer program, 

61. (Cancelled) 

62. (Currently Amended) A method as claimed in claim [[57]]49, wherein said 
checksum value is rotated between each item being added into said checksum. 

63. (Original) A method as claimed in claim 49. wherein said packed computer 
Hie includes an unpacking computer program which upon execution decompresses said 
known computer program. 

64. (Original) A method as claimed in claim 49, wherein said packed computer 
Isle is j Win32 PH file 

05 (Currently Amended) '\ppataUis fot detecting a known computer program 
withm a packed computet file, said packed computer file being unpacked upon execution, 
said appaiatus comprising: 

a tesourcc data reddct tot redding tesourcc data within said packed Lomputcr file, 
said resource data -.peciA nig piogiam resource items used h> said known computet 
program and rcdddbie b> a computet operating system without dependence upon which 
unpacking algorithm ts used by saui packed computer I'de. and 

a tesourcc data compdivstot lor gcucrdttng ehataetensties ol said icsourcc dasa and 
for compuimg said chaiactcnj-tics of said icsomcc data with ehaiaacr-jstii.s of known 
computer program icsourcc da!a lot ducctrng a match with said known computer 
program indicati ve of said packed computer file containing said known computer 
program- 
wherein said resoittcc data of said packed computer file is processed to genet ate 
fingerprint data and to compare said generated fingerprint data w ith know n computer 
program .fingerprint data; 
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w herein said generated fi ngerpriot data includes a number of program resource 
items specified within said resource data of said packed computer tile ; 

wherein said generated ..fingerprint data includes a flag indicating which data is 
included within said generated fi ngerpri nt data; 

wherein said gene ra i cd fi n gcr pr i n t data includes a location within said resource 
data of said packed computer file of an entry specifying a program resource item having a 
larges t s ize; 

wherein said generated fingerprint data includes a checksum value calculated in 
dependence upon : 

a number ot program resource items specified beneath each node within 
hieiaahicaliy anauged rosoutcc d.ua of said packed computer file; 

suing names associated with program resource items within said resource data ol" 
?a!il£.^.!sed.c^ 

si/cs ol" program iesourcc items uitfnn said resource data of said packed computer 

file. 

66. f Original) Apparatus as claimed in claim 65, wherein said known computer 
program is one of: 

a Trojan computer program; and 
a worm computer program. 

67. f Currently .Amended) Apparatus as claimed in claim 65, wherein said resource 
data comparator is operable to compare said resource data of said packed computer file 
with characteristics of a plurality of known computer programs to detect if said packed 
computer program contains one of said plurality of known computer programs. 

68. (Cancel led) 

f>°- (Original) \pparatus as churned m claim fo. wherein said program resource 
items used by said known computer program include one or more of. 
icon data; 
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string data; 
dialog data; 
bitmap data; 
menu data; and 
language data, 

70. (Currently Amended) Apparatus as claimed in claim 65, wherein said resource 
data of said pack ed computer file specifies for each resource item a storage location of 

said resource item, 

71. (Original) Apparatus as claimed in claim 70. wherein said storage location of 
said resource item is specified as an relative offset value. 

"'2. ((_ urremK \mended} Apparatus as claimed in claim <>5„ w herein said resource 
da Ni of sa i d packed com put or ii i c specifies for each resource item a st/e of said resource 

item. 

73. (Cancelled) 

74. (Cancelled) 

75. (Cancelled) 

"fi. (Currently Amended) Apparatus as claimed m claim M. w herein said 
genet died fingerprint dau includes nmcMdmp daid indicative >>i a time of eompdaihrn of 
said known computer program, 

77. (Cancelled) 

78. (Currently Amended) Apparatus as claimed in claim [[ 73]]65, wherein said 
checksum, value is rotated between each item being added into said checksum. 
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"Q (Original) Appataius ix^ claimed m claim wherein said packed composes 
file j no hides an unpacking computer progi am which upon execution decompresses sanl 
l.mnsn computet piogratn. 

SO, (Original) Apparatus as claimed m claim to. wherein said packed computer 
itlessa Wm^2 Pb file 

81 . (Currently Amended) Apparatus for generating data for detecting a known 
computer program ssithm a packed computer J He. said packed computer tile being 
unpacked upon execution, said, apparatus compiling 

a resource data icadei lot reading resource data wuhin said packed computer file. 
s?aid icsoui4.e data specifying ptogiam result! ce items used bv satd knmsu computet 
program and readable b> a computet operating s\siem without dependent. c upon which 
unpacking algorithm ts used hs said packed computer Itie: and 

a ehfiiaUonsUL data generator lot generating chataetenstic data associated with 
^aid resousce data ior comparison with chat aclen she data oi know n computci program 
icsoiitce data and !oj delecting a match Willi said known computer piugraiu indicative of 
said packed computet file containing said known computer ptogram. 

vdieiem said icsoiirec data oi said packed computet file is ptucessed to generate 
ftn&erpitnl data and to compare ->aid generated fingerprint data usth known computer 
program fingerprint data; 

whei'em said generated t'mgctpi tnt data includes- a numbei of program resource 
items spcetticd willun said tesoiiicc daia of said packed computet tile . 

wherein said generated irngcrpttnt data includes a tlag indicating which data u-. 
included utthm said geuctalcd fingcrpimi data; 

wherein satd ueneiatcd Hn^crpinst data includes a k>cat?oii within said resource 
data ol said packed computer hie of an entiy specify tng a program i\soutec item has tng a 
largest size; 

whetein said generated fingerprint data includes a checksum value calculated m 
dependence upon: 
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a number of program resource 'lom» specified beneath each node vsuhm 
hierarchically arranged resource daia of said packed computer tile; 

>JI.U1.S..UM].^ 
said packed computer flic: and 

sizes ol'program resource items within said resource data of said packed computer 

fik- 

82, (Original) Apparatus as claimed in claim 81, wherein said known computer 
program is one of: 

a Trojan computer program; and 
a worm computer program. 

S> iPtestouslx Ptesenied) Appatatus as churned tn (.latin Si. uhctem said 
ctiatactcustic Jala gctiaatoi is opctable to jicnenite ctiaKictcustic data horn a plmalst\ of 
known computer programs toonabL detection o! an^ ol said phnalitx of known 
computet pn>gi<ims withm said packed computer piogtatn 

84. (Cancelled) 

85. (Original) Apparatus as claimed in claim 81. wherein said program resource 
items used by said known computer program include one or more of; 

icon data; 
string data; 
dialog data; 
bitmap data; 
menu data; and. 
language data, 

Xfi (Curteutly \mcndcd) \ppat\uus as claimed m claim X], w herein said tesomee 
data of said packed computet {"tie spec dies for each resource item a storage location of 
said resource item. 



- IB- 



S'? (Ongmal) Appatatus a> ci umed in claim So. wheicm said sioiatic location of 
saidicsouiec nan is spi.es lied as an tcLttnc nil set \aUic 

88 \i mienih Vmusdui) Apparatus as claimed ui claim 81, vdieiem said icsouicc 
data ol said packed computet hie specifics lot each usouiec item a si/c ol said icsuitsce 
item. 

89. (Cancelled) 

90. (Cancelled) 

91. {'Cancelled) 

92 unesith Amended) -Ypparauis as> claimed m claim XI. ulvtem said 
generated linger psmt data includes tunesiamp data indicative vi\\ time of compilation of 
^aid known computer progiam 

93. (Cancelled) 

^ 1 (Current!} Amended) '\ppasatu'- as ekumal in claim ff^9))Sj_. w heiein said 
checksum value is routed between each item being added mto said checksum 

9s (( h'jginal) Appataius as claimed m claim SI. v\ herein said packed composer 
file meUides an unpacking computer progiam which upon execution decompr esses said 
known computer program. 

96. (Original) Apparatus as claimed in claim 81, wherein said packed computer 
fib is a Win32 PE file. 



97. (Cancelled) 
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98, (Previously Presented) A computer program product as claimed in claim 14. 
wherein said checksum value is rotated \ bit lo the left. 



